dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:13318f89903a329a75c0be4220cd12d7b0c81ebcb72c001c4bdc5f4ddfea02c4
Manifest digest:sha256:2633e7731757f7bb91269cdfc86caba06123efcc9b5bd7f26571889b6cb563d8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:879c3f3fa6017859499a913b66d1e6f84307367f25cc5965cb6421bf33fc1e71 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:1f88ebf322ff7214e51df0ead075f907e909afc9fe153f3d673ce44bf8d7a0c7 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:e3b51e25ed8bd7d7d9b74785ddab5193735e5d6b41d2006e49ccfc260090dc04 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:a7382deae4bdb84967652db5b8c36ac3b69d9d8e7c240fcf3dc45315d4f95e15 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:dd7217637dc120821d991222bcff89731df6d9b3076cbbaa42a516e078f613ba |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:185812791af2c8c2d71ec6fdbe90ac5df127e2e0a7e11110c568483c6fe40ee8 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:fca6d11b57af93af9582dd38db56a225fff97d0a4dce4b58b22a7a6c1d317e09 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:d4e42bcd0e87da8c0b702feb2248a16731937af18ce0b2399ce97ebac2798aa9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:73a2fa91b5d8b6577d0a71f806b1eea1ab01d6558ed587ede2104b67d7d0b0cd |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:a709f4ea8b18a139fb96923055680c2c633bd1671fe43930337fd0e34af6ecac |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:2ddd8ba76c1020223a8b05b1445e9a8aab4264910a80bca23f1556bd6996f138 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:d7b397a3ed13b649d477ed2eb35081a8fb2f0cb4534061b2ef8153e102125b50 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:d0cc382516164cd54db53905b2bc421c375a94e11043806994724bef23e9f00f |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:aaf47a201acb6e6905c05a83c014c1e5b57229afe8a31f38fa03e72f8a931503 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:a9b6a03279171c4bf980fbed3a86f8bc01708197e4ff302877fa276be1650c7e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:b1f591fd6e6b601268fb77bc061a6940734f4870a70111758fcaa0f808171bd5 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:f81d1b6813b6d9a0d5a50e688487ffb36e4abb361e8a083b839ac2b0c0feccb1 |